REVIEW 1 major objections 5 minor 1 cited by
Rectified Flow models memorize training images most at the midpoint of their flow, and U-shaped timestep sampling reduces that risk without harming image quality.
Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →
T0 review · grok-4.5
2026-07-15 12:02 UTC pith:L2RNAOU4
load-bearing objection First practical MIA suite for Rectified Flow, a clear midpoint memorization peak with a usable U-shaped fix, and solid empirical gains; the exact LMMSE orthogonality argument is the softest formal link but not load-bearing. the 1 major comments →
Generalization and Memorization in Rectified Flow
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
Under standard uniform temporal training, a Rectified Flow model's susceptibility to membership inference strictly peaks at the integration midpoint t = 0.5; the expected memorization risk over continuous time is upper-bounded by the risk measured at that midpoint. Replacing uniform sampling by a Symmetric Exponential (U-shaped) distribution suppresses the peak and thereby reduces memorization while preserving generative fidelity.
What carries the argument
The complexity-calibrated Monte-Carlo statistic Tmc_cal = Tmc(x,t)/C(x), together with the LMMSE orthogonality argument that at t = 0.5 the state xt becomes uncorrelated with the target velocity, forcing the network off the linear baseline and maximizing sample-specific memorization.
Load-bearing premise
The claim that the peak sits exactly at the midpoint rests on second-moment orthogonality between the noisy state and the target velocity; if the data distribution or the learned velocity field break those moment assumptions, the peak need not stay at t = 0.5.
What would settle it
Train identical Rectified Flow models on the same data with uniform versus Symmetric-Exponential timestep sampling, measure Tmc_cal attack AUC and TPR@1%FPR at many discrete times, and check whether the uniform model still peaks at t = 0.5 while the U-shaped model shows a lower peak and comparable FID.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper studies memorization in Rectified Flow (RF) models via membership inference attacks (MIAs). It derives three test statistics from the Flow Matching and Conditional Flow Matching objectives (Tnaive, Tmc, and a complexity-calibrated Tmc_cal that normalizes by compressed bitrate C(x)), shows large gains from calibration (up to +15 AUC / +45 TPR@1%FPR), and reports that under uniform timestep sampling the MIA signal peaks at the integration midpoint t=0.5. This peak is linked to an LMMSE argument: at t=0.5 the state xt is orthogonal to the target velocity under second-moment assumptions, forcing the network off linear estimators. Replacing uniform sampling by a Symmetric Exponential (U-shaped) schedule is shown to suppress the peak while preserving FID on CIFAR-10, SVHN and TinyImageNet.
Significance. If the empirical pattern and mitigation hold, the work supplies the first non-trivial, RF-specific MIA and a practical temporal regularizer that improves the privacy–utility trade-off without DP-SGD-style noise. The progressive derivation of the three statistics from the training objectives, the explicit complexity calibration motivated by known likelihood biases, the consistent multi-dataset results (Table 2, Figs. 1–3, 8), the released code/checkpoints, and the closed-form LMMSE justification (Appendix E) are concrete strengths that make the claims falsifiable and reusable. The U-shaped schedule re-purposes an existing idea with a new memorization-theoretic rationale, which is a useful contribution for practitioners training large RF models.
major comments (1)
- Section 4 and Appendix E: the claim that susceptibility is strictly upper-bounded by the value at t=0.5 rests on the second-moment orthogonality argument that xt is statistically orthogonal to the target velocity exactly at the midpoint. Image data are high-dimensional and non-Gaussian; the paper should either (i) state the precise moment conditions under which the peak location is guaranteed, or (ii) replace the word “strictly” by “empirically / approximately” and add a short sensitivity check (e.g., non-zero mean or heavy-tailed synthetic data) so that the analytic upper-bound claim is not stronger than the derivation supports. The multi-dataset empirical peak and the U-shaped mitigation remain intact either way.
minor comments (5)
- Figure 1 / Table 2: report the number of Monte-Carlo samples N used for the main Tmc / Tmc_cal numbers (Fig. 5 shows the dependence but the primary tables do not).
- Section 3.2 and Appendix A: the complexity proxy C(x) is the compressed byte length; specify the exact compressor (PNG, JPEG quality, etc.) so that the calibration is reproducible.
- Notation: the same symbol T is used for both the test statistic and the time horizon; a subscript or different letter would avoid momentary confusion when reading Eqs. (5)–(10).
- Appendix B / Fig. 7: the claim that the ordinary training/validation loss gap is uninformative is important; a quantitative measure (e.g., AUC of the loss itself) would make the contrast with Tmc_cal sharper.
- Typos / formatting: “Schocastic” (p. 4), “Recitified” (Appendix B title), and several mid-sentence page breaks / missing figure captions in the supplied PDF should be cleaned.
Circularity Check
No significant circularity: MIA statistics derive directly from FM/CFM objectives, midpoint peak is an empirical observation independently justified by LMMSE orthogonality under stated second-moment assumptions, and U-shaped sampling is an external schedule re-purposed without self-definition.
full rationale
The three test statistics are obtained by rewriting the Flow Matching and Conditional Flow Matching losses (Eqs. 3-4) into evaluable residuals (Tnaive, Tmc) and then dividing by an independent compression-bitrate complexity measure C(x); none of these quantities is defined in terms of the membership labels or the peak location they later measure. The claim that susceptibility peaks at t=0.5 is first reported as an empirical pattern under uniform sampling (Fig. 1) and only afterwards given a separate analytic justification via the LMMSE estimator (Section 4 and Appendix E), which shows statistical orthogonality of xt and the target velocity at the midpoint under global mean/covariance assumptions; the derivation does not presuppose the peak. The Symmetric Exponential schedule is taken from Lee et al. (2024) and merely re-used; no parameter is fitted to the MIA curves and then re-predicted. Self-citations to the authors' prior diffusion-MIA papers appear only as background and are not load-bearing for any equation or bound in the present work. Consequently the derivation chain is self-contained against its own inputs.
Axiom & Free-Parameter Ledger
free parameters (3)
- number of Monte Carlo samples N (#mc) =
5 (main results)
- Symmetric Exponential concentration alpha
- compressed bitrate C(x) as complexity proxy
axioms (4)
- domain assumption Gradient of the marginal Flow Matching objective equals the gradient of the Conditional Flow Matching objective, so optimizing CFM yields the same velocity field as FM.
- ad hoc to paper At t=0.5 the noisy state xt is statistically orthogonal to the target velocity under second-moment assumptions on the data and noise, forcing the network away from the LMMSE linear estimator.
- domain assumption Compressed file size (bitrate) is a sufficient proxy for the intrinsic spatial complexity that biases likelihood and reconstruction scores.
- domain assumption Membership-inference success is a valid quantitative proxy for sample-specific memorization in continuous-time generative models.
read the original abstract
Generative models based on the Flow Matching objective, particularly Rectified Flow, have emerged as a dominant paradigm for efficient, high-fidelity image synthesis. However, while existing research heavily prioritizes generation quality and architectural scaling, the underlying dynamics of how RF models memorize training data remain largely underexplored. In this paper, we systematically investigate the memorization behaviors of RF through the test statistics of Membership Inference Attacks (MIA). We progressively formulate three test statistics, culminating in a complexity-calibrated metric that successfully decouples intrinsic image spatial complexity from genuine memorization signals. This calibration yields a significant performance surge -- boosting attack AUC by up to 15% and the privacy-critical TPR@1%FPR metric by up to 45% -- establishing the first non-trivial MIA specifically tailored for RF. Leveraging these refined metrics, we uncover a distinct temporal pattern: under standard uniform temporal training, a model's susceptibility to MIA strictly peaks at the integration midpoint, a phenomenon we justify via the network's forced deviation from linear approximations. Finally, we demonstrate that substituting uniform timestep sampling with a Symmetric Exponential (U-shaped) distribution effectively minimizes exposure to vulnerable intermediate timesteps. Extensive evaluations across three datasets confirm that this temporal regularization suppresses memorization while preserving generative fidelity.
Forward citations
Cited by 1 Pith paper
-
A Theoretical Analysis of Memory and Overfitting Phenomena in Stochastic Interpolation Models
In the oracle continuous-time setting, stochastic interpolation models recover training samples exactly, with deviations controlled by discretization and estimation errors, leading to theoretical definitions of overfi...
Reference graph
Works this paper leans on
-
[1]
In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security
Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. pp. 308–318 (2016)
2016
-
[2]
arXiv preprint arXiv:2209.15571 (2022)
Albergo, M.S., Vanden-Eijnden, E.: Building normalizing flows with stochastic interpolants. arXiv preprint arXiv:2209.15571 (2022)
Pith/arXiv arXiv 2022
-
[3]
arXiv preprint arXiv:2505.17638 (2025)
Bonnaire, T., Urfin, R., Biroli, G., Mézard, M.: Why diffusion models don’t memorize: The role of implicit dynamical regularization in training. arXiv preprint arXiv:2505.17638 (2025)
arXiv 2025
-
[4]
Advances in neural information processing systems34, 27916–27928 (2021)
van den Burg, G., Williams, C.: On memorization in probabilistic deep generative models. Advances in neural information processing systems34, 27916–27928 (2021)
2021
-
[5]
In: 2022 IEEE symposium on security and privacy (SP)
Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., Tramer, F.: Member- ship inference attacks from first principles. In: 2022 IEEE symposium on security and privacy (SP). pp. 1897–1914. IEEE (2022)
2022
-
[6]
In: 32nd USENIX security symposium (USENIX Security 23)
Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tramer, F., Balle, B., Ippolito, D., Wallace, E.: Extracting training data from diffusion models. In: 32nd USENIX security symposium (USENIX Security 23). pp. 5253–5270 (2023)
2023
-
[7]
In: 2009 IEEE conference on com- puter vision and pattern recognition
Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., Fei-Fei, L.: Imagenet: A large-scale hierarchical image database. In: 2009 IEEE conference on com- puter vision and pattern recognition. pp. 248–255. Ieee (2009)
2009
-
[8]
arXiv preprint arXiv:2210.09929 (2022)
Dockhorn, T., Cao, T., Vahdat, A., Kreis, K.: Differentially private diffusion models. arXiv preprint arXiv:2210.09929 (2022)
Pith/arXiv arXiv 2022
-
[9]
Duan, J., Kong, F., Wang, S., Shi, X., Xu, K.: Are diffusion models vul- nerable to membership inference attacks? In: International Conference on Machine Learning. pp. 8717–8730. PMLR (2023)
2023
-
[10]
In: Forty-first international confer- ence on machine learning (2024)
Esser, P., Kulal, S., Blattmann, A., Entezari, R., Müller, J., Saini, H., Levi, Y., Lorenz, D., Sauer, A., Boesel, F., et al.: Scaling rectified flow transform- ers for high-resolution image synthesis. In: Forty-first international confer- ence on machine learning (2024)
2024
-
[11]
In: Proceedings of the 22nd ACM SIGSAC conference on computer and communications security
Fredrikson, M., Jha, S., Ristenpart, T.: Model inversion attacks that exploit confidence information and basic countermeasures. In: Proceedings of the 22nd ACM SIGSAC conference on computer and communications security. pp. 1322–1333 (2015)
2015
-
[12]
arXiv preprint arXiv:2308.12143 (2023)
Fu,W.,Wang,H.,Gao,C.,Liu,G.,Li,Y.,Jiang,T.:Aprobabilisticfluctua- tion based membership inference attack for diffusion models. arXiv preprint arXiv:2308.12143 (2023)
Pith/arXiv arXiv 2023
-
[13]
arXiv preprint arXiv:2310.17432 (2023) Generalization and Memorization in Rectified Flow 17
Goodier, J., Campbell, N.D.: Likelihood-based out-of-distribution de- tection with denoising diffusion probabilistic models. arXiv preprint arXiv:2310.17432 (2023) Generalization and Memorization in Rectified Flow 17
Pith/arXiv arXiv 2023
-
[14]
arXiv preprint arXiv:1810.01367 (2018)
Grathwohl, W., Chen, R.T., Bettencourt, J., Sutskever, I., Duvenaud, D.: Ffjord: Free-form continuous dynamics for scalable reversible generative models. arXiv preprint arXiv:1810.01367 (2018)
Pith/arXiv arXiv 2018
-
[15]
arXiv preprint arXiv:2310.02664 (2023)
Gu, X., Du, C., Pang, T., Li, C., Lin, M., Wang, Y.: On memorization in diffusion models. arXiv preprint arXiv:2310.02664 (2023)
Pith/arXiv arXiv 2023
-
[16]
arXiv preprint arXiv:1705.07663 (2017)
Hayes, J., Melis, L., Danezis, G., De Cristofaro, E.: Logan: Membership in- ference attacks against generative models. arXiv preprint arXiv:1705.07663 (2017)
Pith/arXiv arXiv 2017
-
[17]
Ad- vances in neural information processing systems33, 6840–6851 (2020)
Ho, J., Jain, A., Abbeel, P.: Denoising diffusion probabilistic models. Ad- vances in neural information processing systems33, 6840–6851 (2020)
2020
-
[18]
arXiv preprint arXiv:2310.02557 (2023)
Kadkhodaie, Z., Guth, F., Simoncelli, E.P., Mallat, S.: Generalization in diffusion models arises from geometry-adaptive harmonic representations. arXiv preprint arXiv:2310.02557 (2023)
Pith/arXiv arXiv 2023
-
[19]
Advances in neural information process- ing systems35, 26565–26577 (2022)
Karras, T., Aittala, M., Aila, T., Laine, S.: Elucidating the design space of diffusion-based generative models. Advances in neural information process- ing systems35, 26565–26577 (2022)
2022
-
[20]
arXiv preprint arXiv:1312.6114 (2013)
Kingma, D.P., Welling, M.: Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114 (2013)
Pith/arXiv arXiv 2013
-
[21]
Advances in neural information processing systems31(2018)
Kingma, D.P., Dhariwal, P.: Glow: Generative flow with invertible 1x1 con- volutions. Advances in neural information processing systems31(2018)
2018
-
[22]
arXiv preprint arXiv:2305.18355 (2023)
Kong, F., Duan, J., Ma, R., Shen, H., Zhu, X., Shi, X., Xu, K.: An efficient membership inference attack for the diffusion model by proximal initializa- tion. arXiv preprint arXiv:2305.18355 (2023)
Pith/arXiv arXiv 2023
-
[23]
Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)
2009
-
[24]
Labs, B.F.: Flux.https://github.com/black-forest-labs/flux(2024)
2024
-
[25]
Labs, B.F., Batifol, S., Blattmann, A., Boesel, F., Consul, S., Diagne, C., Dockhorn, T., English, J., English, Z., Esser, P., Kulal, S., Lacey, K., Levi, Y., Li, C., Lorenz, D., Müller, J., Podell, D., Rombach, R., Saini, H., Sauer, A., Smith, L.: Flux.1 kontext: Flow matching for in-context image gener- ation and editing in latent space (2025),https://a...
2025
-
[26]
Lee,S., Lin,Z.,Fanti,G.:Improvingthetrainingofrectifiedflows.Advances in neural information processing systems37, 63082–63109 (2024)
2024
-
[27]
Li, M., Vitányi, P., et al.: An introduction to Kolmogorov complexity and its applications, vol. 3. Springer (2008)
2008
-
[28]
Advances in Neural Information Processing Systems36, 2097– 2127 (2023)
Li, P., Li, Z., Zhang, H., Bian, J.: On the generalization properties of diffu- sion models. Advances in Neural Information Processing Systems36, 2097– 2127 (2023)
2097
-
[29]
Advances in neural information processing systems37, 57499–57538 (2024)
Li, X., Dai, Y., Qu, Q.: Understanding generalizability of diffusion mod- els requires rethinking the hidden gaussian structure. Advances in neural information processing systems37, 57499–57538 (2024)
2024
-
[30]
arXiv preprint arXiv:2210.02747 (2022)
Lipman, Y., Chen, R.T., Ben-Hamu, H., Nickel, M., Le, M.: Flow matching for generative modeling. arXiv preprint arXiv:2210.02747 (2022)
Pith/arXiv arXiv 2022
-
[31]
arXiv preprint arXiv:2412.06264 (2024) 18 M
Lipman, Y., Havasi, M., Holderrieth, P., Shaul, N., Le, M., Karrer, B., Chen, R.T., Lopez-Paz, D., Ben-Hamu, H., Gat, I.: Flow matching guide and code. arXiv preprint arXiv:2412.06264 (2024) 18 M. Rao and D. Moyer
Pith/arXiv arXiv 2024
-
[32]
arXiv preprint arXiv:2209.03003 (2022)
Liu, X., Gong, C., Liu, Q.: Flow straight and fast: Learning to generate and transfer data with rectified flow. arXiv preprint arXiv:2209.03003 (2022)
Pith/arXiv arXiv 2022
-
[33]
arXiv preprint arXiv:2509.09672 (2025)
Lukoianov, A., Yuan, C., Solomon, J., Sitzmann, V.: Locality in image dif- fusion models emerges from data statistics. arXiv preprint arXiv:2509.09672 (2025)
arXiv 2025
-
[34]
Nalisnick, E., Matsukawa, A., Teh, Y.W., Gorur, D., Lakshminarayanan, B.: Do deep generative models know what they don’t know? arXiv preprint arXiv:1810.09136 (2018)
Pith/arXiv arXiv 2018
-
[35]
In: NIPS workshop on deep learning and unsupervised feature learning
Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., Ng, A.Y., et al.: Reading digits in natural images with unsupervised feature learning. In: NIPS workshop on deep learning and unsupervised feature learning. vol. 2011, p. 4. Granada (2011)
2011
-
[36]
arXiv preprint arXiv:2304.14772 (2023)
Pooladian, A.A., Ben-Hamu, H., Domingo-Enrich, C., Amos, B., Lipman, Y., Chen, R.T.: Multisample flow matching: Straightening flows with mini- batch couplings. arXiv preprint arXiv:2304.14772 (2023)
Pith/arXiv arXiv 2023
-
[37]
arXiv preprint arXiv:2511.20592 (2025)
Rao, M., Qu, B., Moyer, D.: Latent diffusion inversion requires understand- ing the latent space. arXiv preprint arXiv:2511.20592 (2025)
arXiv 2025
-
[38]
arXiv preprint arXiv:2509.25003 (2025)
Rao, M., Qu, B., Moyer, D.: Score-based membership inference on diffusion models. arXiv preprint arXiv:2509.25003 (2025)
Pith/arXiv arXiv 2025
-
[39]
In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High- resolution image synthesis with latent diffusion models. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 10684–10695 (2022)
2022
-
[40]
arXiv preprint arXiv:1909.11480 (2019)
Serrà, J., Álvarez, D., Gómez, V., Slizovskaia, O., Núñez, J.F., Luque, J.: Input complexity and out-of-distribution detection with likelihood-based generative models. arXiv preprint arXiv:1909.11480 (2019)
Pith/arXiv arXiv 1909
-
[41]
Advances in neural information processing systems32 (2019)
Song, Y., Ermon, S.: Generative modeling by estimating gradients of the data distribution. Advances in neural information processing systems32 (2019)
2019
-
[42]
arXiv preprint arXiv:2011.13456 (2020)
Song,Y.,Sohl-Dickstein,J.,Kingma,D.P.,Kumar,A.,Ermon,S.,Poole,B.: Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456 (2020)
Pith/arXiv arXiv 2011
-
[43]
arXiv preprint arXiv:2302.00482 (2023)
Tong, A., Fatras, K., Malkin, N., Huguet, G., Zhang, Y., Rector-Brooks, J., Wolf, G., Bengio, Y.: Improving and generalizing flow-based generative models with minibatch optimal transport. arXiv preprint arXiv:2302.00482 (2023)
Pith/arXiv arXiv 2023
-
[44]
arXiv preprint arXiv:2011.11660 (2020)
Tramer, F., Boneh, D.: Differentially private learning needs better features (or much more data). arXiv preprint arXiv:2011.11660 (2020)
Pith/arXiv arXiv 2011
-
[45]
Van Den Oord, A., Kalchbrenner, N., Kavukcuoglu, K.: Pixel recurrent neuralnetworks.In:Internationalconferenceonmachinelearning.pp.1747–
-
[46]
Research in the Mathematical Sciences9(1), 8 (2022)
Yang, H., E, W.: Generalization error of gan from the discriminator’s per- spective. Research in the Mathematical Sciences9(1), 8 (2022)
2022
-
[47]
In: Proceedings of the IEEE/CVF Conference on computer vision and pattern recognition
Yang, X., Zhou, D., Feng, J., Wang, X.: Diffusion probabilistic model made slim. In: Proceedings of the IEEE/CVF Conference on computer vision and pattern recognition. pp. 22552–22562 (2023) Generalization and Memorization in Rectified Flow 19
2023
-
[48]
In: ICML 2023 workshop on struc- tured probabilistic inference{\&}generative modeling (2023)
Yoon, T., Choi, J.Y., Kwon, S., Ryu, E.K.: Diffusion probabilistic models generalize when they fail to memorize. In: ICML 2023 workshop on struc- tured probabilistic inference{\&}generative modeling (2023)
2023
-
[49]
Advances in Neural Information Processing Systems37, 74122–74146 (2024) 20 M
Zhai, S., Chen, H., Dong, Y., Li, J., Shen, Q., Gao, Y., Su, H., Liu, Y.: Membershipinferenceontext-to-imagediffusionmodelsviaconditionallike- lihood discrepancy. Advances in Neural Information Processing Systems37, 74122–74146 (2024) 20 M. Rao and D. Moyer 7 Appendix A Input Complexity Bias in Likelihood Estimation For a trainedvθ on RF. The evolution of...
2024
-
[50]
B Training/val Loss Gap in Recitified Flow As shown in Fig
The corresponding compressed rate (bytes) is shown for each image. B Training/val Loss Gap in Recitified Flow As shown in Fig. 7, the original RF loss exhibits negligible separability be- tweenD train andD val, suggested by the near-complete overlap (indicated by the purple region) of their±1standard deviation intervals. This renders it largely 22 M. Rao ...
2000
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.